Attack Chain

1. An attacker gains unauthorized access to an AWS account, either through compromised credentials or exploiting a misconfigured IAM role.
2. The attacker enumerates available S3 buckets and identifies a target bucket containing sensitive data.
3. The attacker identifies or creates a KMS key within the AWS environment.
4. The attacker configures the target S3 bucket to use the identified KMS key for encryption of objects stored within it.
5. The attacker uploads or modifies objects within the S3 bucket, triggering encryption using the KMS key.
6. The attacker attempts to exfiltrate the encrypted data.

Impact

Successful exploitation could lead to unauthorized access to sensitive data stored within S3 buckets. Depending on the nature of the data, this could result in financial losses, reputational damage, and legal repercussions. Furthermore, if the attacker controls the KMS key, they could render the data inaccessible, effectively holding it hostage. The impact can vary based on the scope of the compromised data and the attacker's objectives, potentially affecting customer data, intellectual property, or critical business information.

Attack Chain

1. The attacker compromises an AWS account, possibly through credential theft or a vulnerability in an application running within the environment.
2. The attacker uses the compromised AWS credentials to authenticate to the AWS Management Console or via the AWS CLI/API.
3. The attacker issues a CreateKey API call to create a new KMS key using the AWS KMS service.
4. The attacker issues a PutKeyPolicy API call to set the encryption policy for the newly created KMS key.
5. The attacker configures the KMS key policy to grant kms:Encrypt permissions to all principals, effectively making the key publicly usable for encryption operations.
6. The attacker (or another entity) uses the publicly accessible KMS key to encrypt data, potentially rendering it inaccessible to legitimate users.
7. The attacker leverages the unauthorized encryption to disrupt services, extort victims, or cause reputational damage.

Impact

Successful exploitation of this misconfiguration can lead to unauthorized data encryption, potentially disrupting operations and compromising sensitive information across multiple entities. The broad encryption policy allows any principal, including malicious actors, to encrypt data using the KMS key. This can result in data unavailability, extortion attempts, and significant reputational damage. A single compromised key can affect numerous organizations if the key is accessible and used across those entities, increasing the scope and severity of the impact.

Recommendation

• Deploy the Sigma rule Detect AWS KMS Key Creation with Public Encryption Policy to your SIEM and tune for your environment to identify KMS key creation with broad encryption permissions based on Amazon Security Lake logs.
• Investigate any alerts generated by the Sigma rule by examining the api.request.data field in the CloudTrail logs for suspicious principal configurations.
• Review and remediate any existing KMS keys with overly permissive encryption policies, restricting access to only authorized principals.
• Implement multi-factor authentication (MFA) for all AWS accounts to reduce the risk of account compromise and unauthorized key creation.
• Monitor CloudTrail logs for suspicious API calls related to KMS key management, such as CreateKey, PutKeyPolicy, and Encrypt operations using the amazon_security_lake data source.